Implement MontgomeryPoint::to_edwards via 4-isogeny inversion

[MozirDmitriy]

This change implements the previously unimplemented MontgomeryPoint::to_edwards() using the 4-isogeny inverse consistent with the existing forward map in EdwardsPoint::to_montgomery(). It solves the quadratic for y^2 from u, checks discriminant and square roots in the field, and uses the provided sign bit to select the x-sign, returning None on non-residues or invalid denominators. This removes a todo!() panic point, enables Montgomery to Edwards conversion needed for interoperability, and follows existing project style and primitives without changing the public API.

[tarcieri]

The implementation in this PR is very much variable-time. Does it have prior art somewhere?

I'm wondering if a more straightforward constant-time implementation is possible.

#1350 implements the 4-isogeny. I'm wondering if instead you could first convert from Montgomery to twisted Edwards, then leverage that to convert to untwisted Edwards?

cc @daxpedda

[tarcieri]

It seems like at least an initial implementation of this could use a similar method to curve25519-dalek: computing the Edwards y-coordinate from the Montgomery u-coordinate (and sign bit, passed as parameter), and then decompressing.

FWIW, I guess their implementation handles the exceptional cases in variable-time.